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To Whom It May Concern: 


| am writing to you on behalf of the Software & Information Industry Association (SIA) which 
is the principal trade association for the software and digital content industries worldwide. 
SIIA is engaged in the European policy debate and has organized conferences and events on 
issues of interest to European policymakers in Brussels, London, Berlin, and Geneva, as well as 
in Washington, D.C. SIIA has submitted comments to the Article 29 Working Party on data 
breach, automated decision making, and data portability. We are registered in the European 
Commission's Transparency Register (ID number: 5024251 1841 0-86). 


SIIA’s member companies represent the spectrum of providers of information society services 
(ISS). Members make a number of different apps, programs, websites, community 
environments, and connected devices likely to be accessed by children in the UK. Additionally, 
within our membership, a large number of companies provide services to schools and other 
educational providers and are typically providing those services under contract acting as a 
data processor. 


We appreciate the work that went in to the development of the code. We support the 
Government’s desire to keep children safe online and recognize that appropriate and effective 
regulation can be one way to achieve this. We do have concerns about the first draft of this 
proposal and the large impact it will have on the internet today. 


Our responses to select questions in the consultation follow: 


Q5. Do you think this standard gives rise to any unwarranted or unintended consequences? 


Whilst it is absolutely correct to focus on this Issue, it should be done in conjunction with 
industry and focused on practical implementation to not risk endangering useful and 
beneficial services. Rather than bear the cost and complexity and the risk of non-compliance, 
many services could either treat all UK users like children or stop offering their services in the 
UK altogether — as has happened with some websites blocking EU users post-GDPR. As a 
result, some UK teenagers could be excluded from digital services to which their peers have 
access. Children that don’t have identity documents or sufficient parental support could also 
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be denied important online services e.g. Childline, advice and support services, educational 
resources. 


The narrowness of the age groups will be difficult to be apply to children of different 
developmental abilities. Alternatively, it would be difficult to create products for specific 
developmental abilities without collecting data that would likely not be appropriate to collect 
under the Code's own principle of data minimization. 


The narrow age ranges in the proposed code might restrict services to children of similar 
developmental capacities. This could be problematic for children and teenagers that might 
need access to support systems or other information online that could help them learn, 
express their views, and exercise their right to free speech. 


The age ranges also incorporate data subjects up to 18 years old rather than up to the age of 
consent. This could be an effective change of the digital age of consent to 18 years old where 
GDPR expressly says the age Is to be set between 13 and 16. 


There is no proportionality for different businesses and different services, which will 
advantage large global companies over smaller UK businesses. 


Q6. Do you envisage any feasibility challenges to online services delivering this standard? 


The different age ranges will not only require ISS’s to collect more data on who Is using their 
platform but also to build out robust programs for those age groups. This will lead to 
increased compliance, legal, and engineering costs for companies of all sizes. 


The code covers a wide range of issues, many of which may overlap with Online Harms in the 
UK and the GDPR at an EU level, which can impact understanding and ability to comply from 
an operational point of view. The ICO should focus the Code on services that are targeted to 
children based on their marketing, intended or actual audience, and features, or where the 
service provider has actual knowledge that the service is being used by a child. The Code’s 
regulatory scope should be limited to privacy issues and areas with direct connection to 
GDPR. 


Q7. Do you think this standard requires a transition period any longer than 3 months after the 
code come into force? 


Yes. The code creates a number of different age bands that will require new design, 
development, user testing, and a launch that will likely require more than three months of work 
for multiple teams in a company. We encourage the consultation period to be extended to 
allow for cross-industry conversations to allow companies, parents, the third sector, experts, 
and other members of the public to consider proposals in more detail and provide feedback. 
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We suggest an appropriate implementation period be put in place and should be the maximum 
allowed under statute. Additionally, the ICO and the Government should conduct technical, 
economic impact, and feasibility studies before laying the code before Parliament. 


SIIA would be pleased upon request to share additional perspectives with you and your staff at 
your request. 


Respectfully Submitted, 


Sara Kloek 
Director of Education Policy 
Software and Information Industry Association 


